We have detected that you are using Internet Explorer to visit this website. Internet Explorer is now being phased out by Microsoft. As a result, NHS Digital no longer supports any version of Internet Explorer for our web-based products, as it involves considerable extra effort and expense, which cannot be justified from public funds. Some features on this site will not work. You should use a modern browser such as Edge, Chrome, Firefox, or Safari. If you have difficulty installing or accessing a different browser, contact your IT support team.
About this policy
NHS Digital is the information and technology partner to the NHS in England. We are responsible for operating national IT systems and for securely collecting, analysing, publishing and sharing information to improve health and social care in England. Find out more about NHS Digital.
The Office for National Statistics is the UK’s largest independent producer of official statistics and the recognised national statistical institute of the UK. It is responsible for collecting and publishing statistics related to the economy, population and society at national, regional and local levels. It plays a leading role in national and international good practice in the production of official statistics. Find out more about the Office for National Statistics.
Learn more about coronavirus (COVID-19).
The purposes for processing your personal information
NHS Digital and ONS have been asked by Health Data Research UK, the Department for Health and Social Care and the Scientific Advisory Group on Emergencies (SAGE) to create the Research Database to support the National Core Studies programme being led by Health Data Research UK. This programme uses health data and research to inform the long-term response to COVID-19. Making the Research Database available to researchers is supported by the Scientific Advisory Group on Emergencies (SAGE), the New and Emerging Respiratory Threats Advisory Group (NERVTAG), and other Government pandemic advisory groups who will make use of the research enabled by the database.
The Research Database is created from certain health data which NHS Digital already shares with the ONS for its own use for statistical purposes. This is currently only Hospital Episode Statistics but more health data will be added to the Research Database shortly. We will update this privacy notice here when more health data is added.
This health data, which contains personal data, is linked by ONS to ONS’s Census data and Mortality data. All identifying information about individuals in the data is removed by ONS to create the Research Database.
ONS grants access to the Research Database to certain researchers only, called Approved Researchers, who agree to strict conditions for accessing the database. Researchers can also only access the Research Database to carry out statistical research for the purposes of the monitoring and control of COVID-19. ONS also ensures that the data in the Research Database is anonymous when it is accessed by Approved Researchers.
Our legal basis for sharing personal data with ONS
NHS Digital is a controller under the UK General Data Protection Regulation (GDPR) of the health data we share with ONS. We share health data with ONS for statistical purposes under Section 45A and 45C of the Statistics and Registration Service Act 2007 (SRSA).
Under GDPR, we share health data with ONS under:
- Article 6(1)(e) – as processing is necessary for the performance of a task carried out in the public interest, under the SRSA.
- Article 9(2)(g) – as processing is necessary for reasons of substantial public interest. We consider it is substantially in the public interest to permit ONS to process and share health data for its statistical functions and to promote and enable statistical research for COVID-19 purposes through processing the health data to create the Research Database and make anonymous data available to Approved Researchers. We also rely on Paragraph 6 of Part 2 of Schedule 1 of the Data Protection Act 2018 (DPA18) as processing is necessary for statutory and government etc purposes.
- Article 9(2)(j) – as processing is necessary for statistical and research purposes under the SRSA. We also rely on Paragraph 4 of Part 1 of Schedule 1 of the DPA18 as processing is necessary for statistical and research etc purposes.
ONS is a controller under GDPR of the health data we share with it. It is also a controller for the other personal data it processes for statistical purposes and is the controller for the Research Database.
ONS processes health data we share with it for statistical purposes under Section 45A and Section 45C of the SRSA. It creates the Research Database using its powers under Section 23 and 38 of the SRSA. It grants access to the Research Database by Approved Researchers under Section 39(4)(i) of the SRSA. NHS Digital must however consent to this access under Section 45A and Section 45E of the SRSA. NHS Digital is a joint controller with ONS in relation to the giving of this consent.
Under GDPR, ONS processes the health data and other personal data to create the Research Database and to provide Approved Researchers with access to it under:
- Article 6(1)(e) - public task, under the SRSA, and
- Article 9(2)(j) - processing for statistical and research purposes, together with Paragraph 4 of Part 1 of Schedule 1 of the DPA18 - research etc.
National Data Opt Outs
ONS however remove identifiable information from the health data we have shared with them when they create the Research Database, and they only ever share anonymous data with Approved Researchers. The National Data Opt Out does not apply to anonymous information which is used for research purposes, as it can no longer identify you.
The types of personal information processed by ONS in the Research Database
The following types of personal information are processed by ONS in the Research Database:
- The ONS Census 2011 data within the database includes age, sex, occupation, ethnicity, tenure, socio-economic class, religion and marital status.
- The ONS Mortality data within the database includes date and cause of death.
- The health data we have shared with ONS which is included within the database are flags based variables which are linked to the 2011 Census data and Mortality data. Each flag indicates whether there is evidence (yes or no) of a particular illness or condition for a person based on hospital admissions since 2017, for example, cardiovascular disease.
ONS ensures that the data in the Research Database is anonymous when it is accessed by Approved Researchers.
For more information about how ONS uses personal information, including contact details for their data protection officer please see their Privacy Information
For more information about the health and care information NHS Digital collects, analyses, publishes and shares and what choices and rights you have, see how we look after your health and care information, our general transparency notice and our Coronavirus (COVID-19) response transparency notice
Changes to this notice